Internal Controls Policy Highlights
Background
The Regents of the University of California have adopted the principles of internal controls published by the Committee of Sponsoring Organizations (COSO) of the Treadway Commission.
UC San Diego is committed to upholding the principles of internal controls published through COSO’s Internal Control – Integrated Framework.
In coordination with the University of California, Office of the President, UC San Diego develops campus-wide policies and procedures to ensure a system of internal control is maintained per policies established by the Board of Regents of the University of California and the University of California, Office of the President.
Why perform control activities
An internal control is an action your department takes to prevent and detect errors, omissions, or potentially fraudulent transactions in its financial statements. Your department should already have key financial review and follow-up activities in place. Ongoing monitoring activities and other planned actions to address risks result in an effective internal control system. This ensures sound business practices, which minimizes our risk of inaccurate financial information and maintain public trust.
To fulfill documentation requirements, departments should review those activities and identify key controls.
Be able to answer these questions:
- What controls exist?
- Are those controls working?
- Are those control activities documented, properly performed, and reviewed?
Why documenting control activities is critical
- All units are required to document their performance and certification of control activities.
- A checklist has been developed to assist departments with documenting who performed and certified the control activities. See the control activities section below for more information.
- It provides documented evidence that internal control activities are performed regularly.
- Documentation must provide evidence of performance and demonstrate that review and corrective action were completed. Communications like emails, letters, and chat messages can be part of the documentation to be saved.
- Retention of documentation is necessary for audit purposes.
- Documentation should be saved electronically, in a location determined by the department’s leadership, and accessible to authorized personnel.
- If electronic sign-off is used, performers and certifiers should consider using electronic signature tools, like DocuSign, to document timeliness or review.
Responsibilities
- Performer is an individual within the department responsible for creating and storing the underlying documentation of the internal controls review. A performer should not review or certify their work.
- Certifier is an individual (i.e., department head, Department Business Officer, or Management Services Officer) within the department other than the performer. A certifier will verify that the control activities have been performed appropriately and within the prescribed accounting period.
- Department Head establishes and delegates responsibilities to Department Administrators (i.e., the Performer and Certifier roles) within the department. Department heads are ultimately responsible for ensuring control activities have been completed. Contact Internal Controls & Accounting via Services and Support if you have questions about the delegation.
- Department Administrators are responsible for ensuring that internal controls are established, properly documented, and maintained for activities within their jurisdiction and areas of responsibility.
- Vice Chancellor offices should have jurisdiction over their departments and may have additional requirements for department administrators to follow.
- Internal Controls & Accounting provides guidance and best practices for control activities (i.e., policies and procedures).
- Audit and Management Advisory Services will have access to the documentation of control activities completed by departments, upon request.
Resolving internal control deficiencies
Control deficiencies exist when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements promptly. Materiality of the control deficiency is not just determined by the actual misstatement (i.e., dollar amount of the error), but by the potential dollars that could also be incorrect. Examples of control deficiencies include:
- Lack of timeliness of cash deposits and account reconciliation
- Lack of review and reconciliation of departmental expenditures
- Lack of overdraft funds monitoring
- Lack of physical inventory
Department administrators and managers are responsible for prompt and effective corrective action on internal control findings and for implementing remediation or action plans as internal and external auditors recommend.
External Auditors Responsibility
"Communicating Internal Control Related Matters Identified in an Audit" is an auditing standard that establishes auditors' responsibility for determining the seriousness of internal control issues. It is applicable whenever an auditor expresses an opinion on financial statements (including a disclaimer of opinion).
- Defines the terms "significant deficiency" and "material weakness," incorporating the definitions already in use for public companies.
- Significant deficiencies are a control deficiency, or combination of control deficiencies, that adversely affect the entity's ability to initiate, authorize, record, process, or report financial data reliably in accordance with Generally Accepted Accounting Principles (GAAP) such that there is more than a remote likelihood that a misstatement of the entity's financial statements (that is more than inconsequential) will not be prevented or detected.
- Material weakness is a significant deficiency, or combination of significant deficiencies, that results in more than a remote likelihood that a material misstatement of the financial statements will not be prevented or detected.
- Guidance on evaluating the severity of control deficiencies identified in an audit of financial statements.
- Requires the auditor to communicate in writing to management and those charged with governance, such as the University Board of Regents, significant deficiencies and material weaknesses identified in an audit.
What does this mean to us?
Auditing standards require a lower threshold for reporting internal control deficiencies to the Chancellor and the UC Regents. This closer scrutiny of controls and reporting of matters not previously considered significant could concern the University and its stakeholders unnecessarily. Key controls currently identified for the preparation of the financial statements are not the only controls that need to be monitored. Other controls exist for governance and regulatory compliance, and they also must be followed. Consequently, there are important implications for all campus departments, including central business offices.